> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fastly

> Deliver Fastly access logs to Profound through Amazon S3.

## Overview

Send Fastly access logs to your assigned Profound S3 destination to see agent traffic in Agent Analytics. This guide covers Fastly CDN services using VCL and SSE-S3 encryption.

<Info>
  Contact [Profound support](mailto:support@tryprofound.com) to receive your bucket name, destination prefix, region, and IAM role ARN before enabling delivery.
</Info>

For delivery over HTTP, use the [Fastly HTTPS integration](/agent-analytics/fastly). For a Fastly Compute service, contact support to confirm the logging configuration.

## Prerequisites

* Access to the Fastly service that handles your website's traffic.
* Permission to edit logging endpoints and activate a service version.
* Your Fastly account ID, which Profound needs to configure delivery permissions.

## Encryption

This guide uses **SSE-S3 (AES256)** to encrypt your logs at rest with keys managed by Amazon S3.

## Configuration

<Steps>
  <Step title="Get your destination settings">
    Contact Profound support with your domain and Fastly account ID. Profound configures the source and a role that allows Fastly to write to your assigned destination.

    You will receive a bucket name, destination prefix, region, and role ARN. Use the prefix exactly as provided, including the trailing slash. The prefix identifies your source.

    ```text theme={null}
    s3://<assigned-bucket>/<assigned-prefix>/
    ```

    The role ARN is the authorization value for this setup. You do not need AWS access keys or a Profound HTTP ingestion token.
  </Step>

  <Step title="Create an S3 logging endpoint">
    Open your Fastly service and edit a service version. In its logging settings, create an **Amazon S3** endpoint.

    | Setting                | Value                                                                                      |
    | ---------------------- | ------------------------------------------------------------------------------------------ |
    | Name                   | A descriptive name                                                                         |
    | Bucket name            | The bucket supplied by Profound                                                            |
    | Path                   | Your complete assigned prefix, including the trailing slash                                |
    | Domain                 | The S3 endpoint for the supplied region; for `us-west-2`, use `s3.us-west-2.amazonaws.com` |
    | Access method          | **IAM Role**                                                                               |
    | IAM role ARN           | The role supplied by Profound                                                              |
    | Server side encryption | **Amazon S3-managed keys (SSE-S3 / AES256)**                                               |

    Keep the default logging placement. Follow Fastly's [S3 endpoint guide](https://www.fastly.com/documentation/guides/integrations/logging-endpoints/object-and-cloud-storage/log-streaming-amazon-s3/) for the current control-panel layout.
  </Step>

  <Step title="Set the log format">
    Paste this template into **Log format** as a single line. It emits the fields expected by Profound's Fastly processor.

    ```text theme={null}
    {"timestamp":"%{begin:%Y-%m-%dT%H:%M:%S%z}t","client_ip":"%{req.http.Fastly-Client-IP}V","host":"%{json.escape(req.http.Host)}V","url":"%{json.escape(req.url)}V","request_method":"%{json.escape(req.method)}V","request_referer":"%{json.escape(req.http.Referer)}V","request_user_agent":"%{json.escape(req.http.User-Agent)}V","response_status":%{resp.status}V,"response_body_size":%{resp.body_bytes_written}V}
    ```

    | Fields                                  | Used for                    |
    | --------------------------------------- | --------------------------- |
    | `timestamp`                             | Request time                |
    | `client_ip`                             | Client address              |
    | `host`                                  | Requested domain            |
    | `url`, `request_method`                 | Requested resource          |
    | `request_referer`, `request_user_agent` | Referral and agent analysis |
    | `response_status`, `response_body_size` | Response details            |

    Use **Blank** for the log line format (`message_type=blank`) so no syslog prefix is added. Each line must contain one JSON object. Profound does not accept the default space-separated log format or a JSON array for this S3 integration.

    Use uncompressed output or gzip. Gzip filenames must end in `.gz` so Profound can decompress them. Do not enable PGP encryption, Snappy, or Zstandard for this setup.
  </Step>

  <Step title="Filter to your domain">
    Attach a logging condition that matches the hostname you want to monitor. For example:

    ```text theme={null}
    req.http.host == "example.com"
    ```

    Replace `example.com` with your hostname. Include any additional hostnames you intend to monitor in your condition.
  </Step>

  <Step title="Enable delivery">
    Once Profound confirms your source is ready, save the endpoint and activate the service version. Generate traffic to the configured domain and allow time for Fastly to deliver a log file.

    The endpoint's **Period** setting controls how frequently files are finalized. Check that setting when estimating when your test traffic will arrive.
  </Step>
</Steps>

## Verify ingestion

Open Agent Analytics for your domain and select a date range covering your test requests. Confirm that expected agent traffic appears after delivery and processing.

If data is missing, contact support with your domain, Fastly service ID, endpoint name, request time, and any delivery error or S3 file path. Do not include credentials.

## Troubleshooting

| Problem                               | What to check                                                                                                              |
| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| Fastly cannot assume the role         | Verify the role ARN and the Fastly account ID supplied during setup. Ask Profound to check the role's trust configuration. |
| S3 reports AccessDenied               | Check the bucket, prefix, regional endpoint, and encryption setting against your assigned values.                          |
| Delivery succeeds but data is missing | Confirm source readiness, the `host` field, and your selected date range.                                                  |
| Records cannot be processed           | Use the single-line JSON template and Blank log line format. Check compression settings.                                   |
| No files arrive                       | Confirm that the service version is active, traffic matches the condition, and the file delivery period has elapsed.       |

## Additional Resources

* [Fastly: Log streaming to Amazon S3](https://www.fastly.com/documentation/guides/integrations/logging-endpoints/object-and-cloud-storage/log-streaming-amazon-s3/)
* [Fastly S3 endpoint settings](https://www.fastly.com/documentation/reference/api/logging/s3/)
* [Fastly HTTPS integration](/agent-analytics/fastly)
* [Contact Profound support](mailto:support@tryprofound.com)